CFI confirms SFC’s powers to seize and require passwords to digital devices

On 14 February 2020, Court of First Instance (CFI) judge Mr Justice Anderson Chow handed down a judgment ([2020] HKCFI 270) dismissing 5 applications for judicial review of a number of search warrants authorizing the Securities and Futures Commission (SFC) to search the applicants’ premises and the SFC’s decisions to seize and retain various digital devices belonging to the applicants in the course of execution of the search warrants and to issue notices pursuant to section 183(1) of the Securities and Futures Ordinance (SFO) requiring the applicants to provide the passwords to their email accounts or digital devices.

The Search Warrants. The applicants argued that the search warrants were unlawful and invalid for want of specificity. The Judge observed that as a matter of principle, what is required to be set out in a search warrant is to be determined by the empowering statute. There is no overriding or overarching requirement for specificity outside what is mandated by the relevant statute authorizing the issue of the search warrant. The relevant statue, i.e. section 191(1) of the SFO, does not require the search warrant to state the relevant offence or misconduct under investigation, nor does it require the search warrant to include or set out a “protocol” on how examination of the contents of the digital devices should be carried out in order to protect the privacy of the applicants. In conclusion, the Judge rejected the applicants’ contention that the warrants were unlawful or invalid for want of specificity.

Digital devices are “records” or “documents” in the SFO. On the question whether the SFC has the power to seize digital devices under the relevant provisions of the SFO, the Judge found that the wide definitions of the words “records” or “documents” which may be required to be produced under Part VIII of the SFO include digital devices such as mobile phones, tablets, computers and discs as it would be “wholly out of touch with reality” to read the relevant provisions of the SFO, which are plainly designed to assist the SFC in the discharge of its investigative functions under Part VIII of the SFO and which authorize or require the production, search, seizure and removal of records and documents relevant to the SFC’s investigations, as excluding such digital devices from the scope of those provisions.

Seizure of Digital Devices. On the question whether the seizure of digital devices was unlawful or unconstitutional as it disproportionately interfered with the applicants’ right to privacy under the Basic Law (BL 30) and/or the Hong Kong Bill of Rights (BOR 14). The Judge observed that it is trite that the right to privacy is not absolute, but may lawfully be restricted provided that the restriction can satisfy the 4-step proportionality test established in Hysan Development Co Ltd v Town Planning Board (2016) 19 HKCFAR 372, namely, (i) “legitimate aim”, (ii) “rational connection”, (iii) “no more than reasonably necessary”, and (iv) “fair balance”. The first and second elements are easily satisfied on the facts of the case with the legitimate aim being the SFC investigations and the seizures being rationally connected to the advancement of that aim. As for the third element, the Judge examined the circumstances of the relevant seizures and found that they were no more than reasonably necessary as the devices appear to contain materials relevant to the SFC investigations. In respect of the fourth element, the Judge found that there was a fair balance in place as the SFC offered safeguards to protect the privacy of the applicants, such as using keyword searches to identify relevant materials contained in or accessible through the digital devices and/or viewing the contents together with the applicants. In conclusion, the Judge was of the view the interference with the applicants’ right to privacy occasioned by the SFC’s seizures of the digital devices satisfies the 4-step proportionality test established in Hysan, and is thus lawful and constitutional.

Requiring Passwords. As to the SFC’s decisions to issue s.183(1) notices requiring the applicants to provide the passwords to their email accounts or digital devices, the Judge observed that as a matter of principle, where a warrant authorizes the seizure of a particular document, the officer empowered by the warrant is lawfully entitled to seize the whole file containing the document, without having to separate the individual sheet authorized to be seized, for the purpose of examination at the police station, provided that what he does is reasonable in the circumstances (see Reynolds v Commissioner of Police of the Metropolis [1985] 1 QB 881, at 890A-B). This principle has been extended to authorise the seizure of a computer hard disk, or the taking of an image of the hard disk, containing relevant documents even though it would almost inevitably contain vast amounts of personal or private materials which are not relevant to the law enforcement agency’s investigation. The underlying reason appears to be driven by the practical reality that information, documents and records are nowadays mostly kept in digital or electronic forms and stored in (inter alia) email accounts and digital devices which (i) would almost inevitably contain large amounts of personal or private, but irrelevant, materials, and (ii) are often also protected by specific login names/IDs and passwords. For the same reasons, the Judge considered that the SFC is empowered, under s.183(1), to require the applicants to provide means of access to email accounts and digital devices which contain, or are likely to contain, information relevant to its investigations even though the email accounts and digital devices would likely also contain other personal or private materials which are not relevant to the SFC’s investigations.

Conclusion. This judgment demonstrates the Hong Kong court’s willingness to construe relevant legislation with reference to the practical realities of modern day commercial activities so as to strike an appropriate balance between the proper investigation of possible breaches or contraventions of the SFO and maintenance of market integrity, which plainly are matters of high importance given Hong Kong’s position as a leading regional financial centre, and an individual’s constitutional right of privacy, which is equally important so as to maintain Hong Kong’s good ranking in the world’s rule of law index.

Key Contacts

Carmen Ng

Partner | Litigation and Dispute Resolution

Email or call +852 2825 9502